Ransom.Win64.RHYSIDA.THEBBBC

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It drops files as ransom note.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Ransomware drops the following files:

• %Public%\bg.jpg

(Note: %Public% is the folder that serves as a repository of files or folders common to all users, which is usually C:\Users\Public in Windows Vista, 7, and 8.)

It adds the following processes:

• cmd.exe /c reg delete "HKCU\Conttol Panel\Desktop" /v Wallpaper /f
• cmd.exe /c reg delete "HKCU\Conttol Panel\Desktop" /v WallpaperStyle /f
• cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /v NoChangingWallPaper /t REG_SZ /d 1 /f
• cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /v NoChangingWallPaper /t REG_SZ /d 1 /f
• cmd.exe /c reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "%Public%\bg.jpg" /f
• cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v Wallpaper /t REG_SZ /d "%Public%\bg.jpg" /f
• cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v WallpaperStyle /t REG_SZ /d 2 /f
• cmd.exe /c reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d 2 /f
• rundll32.exe user32.dll,UpdatePerUserSystemParameters
• cmd.exe /c start powershell.exe -WindowStyle Hidden -Command Sleep -Milliseconds 500; Remove-Item -Force -Path "{Malware File Path}\{Malware File Name}" -ErrorAction SilentlyContinue; → executed to delete itself after execution

(Note: %Public% is the folder that serves as a repository of files or folders common to all users, which is usually C:\Users\Public in Windows Vista, 7, and 8.)

Other System Modifications

This Ransomware changes the desktop wallpaper by modifying the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
ActiveDesktop
NoChangingWallPaper = 1

(Note: The default value data of the said registry entry is 0.)

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Policies\
ActiveDesktop
NoChangingWallPaper = 1

(Note: The default value data of the said registry entry is 0.)

HKEY_CURRENT_USER\Control Panel\Desktop
Wallpaper = %Public%\bg.jpg

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Policies\
System
Wallpaper = %Public%\bg.jpg

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Policies\
System
WallpaperStyle = 2

(Note: The default value data of the said registry entry is 0.)

HKEY_CURRENT_USER\Control Panel\Desktop
WallpaperStyle = 2

(Note: The default value data of the said registry entry is 0.)

It sets the system's desktop wallpaper to the following image:

• %Public%\bg.jpg
  

Other Details

This Ransomware does the following:

• It displays its activity on the console.
• It initializes resources based on the number of processors available in the system.
• It encrypts all system drives from A to Z.
• It deletes itself after execution.
• It displays the following after execution:
  

It accepts the following parameters:

• -d {path to encrypt} → used to specify directory to encrypt
• -sr → self-remove modifier

Ransomware Routine

This Ransomware avoids encrypting files with the following strings in their file name:

• .bat
• .bin
• .cab
• .cmd
• .com
• .cur
• .diagcab
• .diagcfg
• .diagpkg
• .drv
• .dll
• .exe
• .hlp
• .hta
• .ico
• .lnk
• .msi
• .ocx
• .ps1
• .psm1
• .scr
• .sys
• .ini
• Thumbs.db
• .url
• .iso
• .cab

It avoids encrypting files found in the following folders:

• $Recycle.Bin
• Boot
• Documents and Settings
• PerfLogs
• Program Files
• Program Files (x86)
• ProgramData
• Recovery
• System Volume Information
• Windows
• $RECYCLE.BIN

It appends the following extension to the file name of the encrypted files:

• .rhysida

It drops the following file(s) as ransom note:

• {Encrypted Directory}\CriticalBreachDetected.pdf